Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

You can change your number

signal.org

Post reply on HN
Print view View original

131–140 of 410 posts

Re: You can change your number

#131

Post by tptacek »

gojomo wrote: post #119
tptacek wrote: post #92

Earlier quoted context omitted.

Signal having the contact list means that they'd be subject to legal (and extralegal) process to obtain the entire contact list for everybody using the service, which is untenable for them. Again: Signal is not Discord or WhatsApp; these are different services with different primary objectives.

Because the app constantly prompts for contact-list access, Signal's software-on-device definitely has the contact list. And, that software regularly re-sends that encrypted list to Signal's servers' SGX enclaves for their contact-discovery protocol. So whether or not Signal, or some entity near/around it, "has" the contact list is a matter of how much users trust Intel™ SGX® (as well as the chain of processes that d…

I haven't kept up with what they're doing so grain of salt on this, but I think this is incorrect.

What they're moving towards is a design that looks like what Apple did with their HSM quorum system. The contact information we're talking about is encrypted clientside, but with (usually) a memorable pin. Without countermeasures, memorable PINs are very easy to attack; SGX allows them to artificially limit guesses. As a user, you retain a security dial on this: you can use a more complicated passcode than a 4-digit pin if you don't trust SGX.

Obtaining the whole database Signal maintains gives you ciphertext that you need to mount attacks on user-by-user (and to make those attacks, you'd have to break SGX). It doesn't simply give you the plaintext SQL database other messaging systems collect.

Re: You can change your number

#132

Post by fragmede »

Talanes wrote: post #72
jack_pp wrote: post #60

Earlier quoted context omitted.

I'm sorry but do you need data for common sense? Is WhatsApp one of the biggest messaging platforms where people don't talk to their close friends and family? You think discord or other mediums are more popular than iMessage and WhatsApp?

I mean, I guess I do? I'm legitimately unsure if I'm in some weird bubble where no one uses WhatsApp or you're in a bubble of unusually high usage. But it's been a small enough part of my life that I'm not even fully sure what the connection is. It uses your contact list as well?

In today's individualized, algorithmic online world, it's safer to assume you're in a weird bubble until proven otherwise. My Twitter/Facebook/whatever feed is totally different than yours. Everyone still has a Facebook account (though; noticeable dip in Q1) and Snapchat is still wildly popular.

Re: You can change your number

#133

Post by tgsovlerkhgsel »

tptacek wrote: post #22
viccuad wrote: post #9

Earlier quoted context omitted.

Oh, I'm surprised, after a decade stating that phone numbers were great for ID.

They're great compared to the alternative of simply storing a plaintext register of every pair of communicating parties on the server, which is how other messengers work. What's "good" about phone numbers is that they're tied clientside to a "buddy list" that everyone already keeps --- their contact list. They don't want phone numbers on the merits of phone numbers.

They're also critical to getting people to move from WhatsApp.

Next time when Facebook pulls something user-hostile (e.g. monetization with ads, yet another privacy policy change for the worse, ...) some people will simply install Signal. If they use phone numbers as (an) identifier, two people who do this independently can immediately switch to Signal.

If A convinces B to switch, and C convinces D to switch, B and D can now talk to each other, reducing the pressure to keep WhatsApp as more and more of your friends are reachable on Signal. Even if you're using WhatsApp in addition to Signal, with phone numbers as identifiers, you're no longer contributing to the network effect that makes it painful for your friends to switch from WhatsApp to Signal.

Given that network effect is what makes or breaks messengers, phone numbers as the primary identifier are the only reasonable choice.

Re: You can change your number

#134

Post by thaumasiotes »

tptacek wrote: post #22
viccuad wrote: post #9

Earlier quoted context omitted.

Oh, I'm surprised, after a decade stating that phone numbers were great for ID.

They're great compared to the alternative of simply storing a plaintext register of every pair of communicating parties on the server, which is how other messengers work. What's "good" about phone numbers is that they're tied clientside to a "buddy list" that everyone already keeps --- their contact list. They don't want phone numbers on the merits of phone numbers.

> They're great compared to the alternative of simply storing a plaintext register of every pair of communicating parties on the server, which is how other messengers work.

> They don't want phone numbers on the merits of phone numbers.

I thought they were pretty vocal about wanting to use phone numbers to save people from the pain and despair of having to enter their friends' usernames into Signal, a pure UI concern.

The server needs to store each pair of communicating parties if it wants to announce presence information like AIM did. But that's unnecessary for a phone-based messenger - everyone is always "present" at all times.

Re: You can change your number

#135

Post by _joel »

YaBomm wrote: post #10

Not sure why you need a phone number? besides government and/or ad tracking. This is why I use Matrix/Element

What's a universal thing to the portable device that everyone has got in their pocket? I agree it's sucky and really there could be better ways, should be something none trackable and perhaps offer opt-in discovery via phone book.

Have the option of decoupling it entirely from the phone.

The government can track you a lot easier than pinging via signal btw. A lot easier!

Re: You can change your number

#136

Post by rcarback »

It is early stage, but there is now an alternative to Signal that doesn't use phone numbers at all:

https://xx.network/messenger/

While you can add your number to be searchable by others, it doesn't let strangers with your number know you signed up automatically, either.

Full disclosure: I work on the infrastructure behind it.

Re: You can change your number

#137

Post by izacus »

not2b wrote: post #36
jessriedel wrote: post #25

Earlier quoted context omitted.

Yea, it seems like this is the most information they could give you without violating the addressee's privacy by revealing whether they have uninstalled the app. I suppose it could be worth it if, when the message remains undelivered for a while, Signal added an explicit note to that effect so the sender doesn't misunderstand.

How can they tell that a user has uninstalled the app? Does uninstalling send a notification to signal.org?

FCM system they use to deliver notifications will return the delivery ID as no longer valid after uninstall though.

Re: You can change your number

#139

Post by charcircuit »

recursive wrote: post #117
jack_pp wrote: post #60

Earlier quoted context omitted.

I'm sorry but do you need data for common sense? Is WhatsApp one of the biggest messaging platforms where people don't talk to their close friends and family? You think discord or other mediums are more popular than iMessage and WhatsApp?

Is any of this stuff more popular than actually calling people? How are people calling? Memorize phone numbers? I'm completely stumped about how someone could use a cellphone for a decade without using a contact list.

I don't even have my friends' phone numbers. If I want to call a friend I do it on my desktop using Discord. Before like 2016 we would call using Skype instead.

Re: You can change your number

#140

Post by charcircuit »

stjohnswarts wrote: post #90
doc_gunthrop wrote: post #68

Earlier quoted context omitted.

Not only do they keep your friend information on their servers, they maintain a copy of every single message you've ever sent via Discord. Their service is the antithesis of private communications.

Can you request deletion of these? I've never really thought about that before (I don't use discord that much anyway other than hoping on some channels occasionally to help beginners to rust and c++. I guess I'm not giving away too much there :)

Yes, you can.
Post reply on HN